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Abstract 



All incoherent as well as 2- and 3-qubit coherent eavesdropping strategies on the 6 state 
protocol of quantum cryptography are classified. For a disturbance of 1/6, the optimal inco- 
herent eavesdropping strategy reduces to the universal quantum cloning machine. Coherent 
£Sj ■ eavesdropping cannot increase Eve's Shannon information, neither on the entire string of 

^ \ bits, nor on the set of bits received undisturbed by Bob. However, coherent eavesdropping 

can increase as well Eve's Renyi information as her probability of guessing correctly all bits. 
The case that Eve delays the measurement of her probe until after the public discussion on 
error correction and privacy amplification is also considered. It is argued that by doing so, 
\ Eve gains only a negligibly small additional information. 
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1 Introduction 



ON 

Quantum cryptography, a protocol based on quantum physics for secret key agree- 
ment between two distant parties 0, plays two central roles in the field of quantum 
information processing (2j. First, it is the most advanced development in the field of 
quantum information processing and it could be the very first application of quan- 
tum mechanics at the individual quanta level. This is possible because quantum 
cryptography can be implemented using only 1-qubit technologies, usually one pho- 
ton, contrary to quantum repeaters ||, quantum teleportation Q or, more generally, 



quantum computers ||2[ that require the coherent processing of tens or even thousands 
of qubits. Next, besides this quite practical role, the analysis of various eavesdrop- 
ping strategies on quantum cryptography systems presents very instructive views on 
the advantages that one can or cannot expect from coherent processing of several 
qubits. Indeed, except the trivial intercept-resend strategy, eavesdropping requires 
to let one or several auxiliary qubits interact coherently with the qubits send by 
Alice to Bob. For example, the eavesdropping strategy on the the 4-state protocol 
(known as the BB84 protocol Q) optimal from Eve's Shannon information point of 
view has been found to be intimately related to the Bell inequality (an inequality 
that clearly deals with a 2-qubit scenario) H ^. Similarly, for the 6-state protocol 
Q , optimal eavesdropping is related to optimal quantum cloning [|| . 

In this article we analyse general eavesdropping strategies on the 6-state protocol. 
The symmetry of this protocol simplifies considerably the analysis (compared to 
the 4-state protocol), in particular it reduces the number of parameters necessary 
to describe general strategies. This motivates our choice to analyse this protocol, 
although the experimental demonstrations all use either the 2-state or the 4-state 
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protocol. In the next section, the 6-state protocol is described. Section ^ defines and 
analyses general incoherent eavesdropping strategies, various optimization (Shannon 
and Renyi information, probability of success on all or some qubits, etc) are presented 
and the connection to the quantum cloning machine is made in section 3.1. Coherent 
eavesdropping on pairs of qubits is fully analysed in section ^| and similarly for 3 
qubits in section ||. The case Eve delays her measurement until after the error 
correction and privacy amplification phase of the protocol is discussed in section || 
Cumbersome computations and formulas are summarized in appendices. 



2 The 6-state cryptographic protocol 

The 6-state or 3 bases cryptographic scheme is nothing but the well-known BB84 4- 
state scheme with an additional basis p|]. When represented on the Poincare sphere 
the BB84 protocol makes use of the four spin-1/2 states corresponding to ±x and 
±y directions. In brief summary; Alice sends one of the four states to Bob, who 
measures the qubits he receives in either the x or the y-basis. A priori this gives a 
probability 1/2 that Alice and Bob use the same basis. In other words on average 
Alice and Bob have to discard half of the qubits even before they can start extracting 
their cryptographic key. 

In the 6 state protocol the two extra states correspond to ±z, i.e. the 6 states 
are ±x, ±y and ±z on the Poincare sphere. In this case Alice sends a state chosen 
freely among the 6 and Bob measures either in the x, y or z-basis. Here the a prior 
probability that Alice and Bob use the same basis is reduced to 1/3, which means 
that they have to discard 2/3 of the transmitted qubits before they can extract a 
cryptographic key. However, this scheme does hold an advantage compared to the 
BB84 protocol — higher symmetry. As it will be seen this fact together with the 
use of symmetric eavesdropping strategies dramatically reduced the number of free 
variables in the problem under investigation. 



3 Single qubit attacks — incoherent eavesdropping 

In the incoherent eavesdropping strategies Eve performs single qubit attacks, which 
means that she investigates each qubit sent by Alice individually. One of Eve's 
major concerns is not to reveal herself in a too straightforward manner, for example 
by introducing different error rates in the different bases, she therefore applies a 
symmetric eavesdropping strategy which treats all Alice's qubits on an equal footing 
H . For each qubit Eve attaches a probe, initially in the state | ) and let the system 
undergo the following unitary evolution: 

|fc}®|0) VF\ k) OVo + v^l -k) <8>Vi m 

|-ft}<8>|0) V^|-fc)®^ + >/5|fc}®^r* 

where k = x,y, z, F is the fidelity, D = 1 — F is the disturbance and ijn denotes 
the state of Eve's probe in the case where Alice sent the qubit in state k and Bob 
received it disturbed (j = 1) or undisturbed (j = 0) (i.e. j indicates the number 
of disturbed qubits). Recall that the disturbance is the probability that Bob gets a 
wrong bit when he measures the qubit in the bases compatible with the state send 
by Alice (sometimes disturbance is called QBER for Quantum Bit Error Rate). The 
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ipj are not arbitrary, but determined by the constrain that the transformation (|l|) 



is unitary. Using the Schmidt decomposition [ 10 1 and unitarity of the interaction U 
the V'o an d V'l-states can be chosen such that ( ■i/V I ipi 3 ) = for all i, j = x, y, z. For 
example, for the z-states the unitary evolution result in: 



«)®|0) VF\z)®if% + VD\-z)®ift (2) 

-z}®\0) VF\-z)®ipQ Z + VD\z)®^ z 



The parametrization of ipQ and if)f can be conveniently and without loss of generality 
chosen as 

V>§ = (1, 0, 0, 0) , i>Q Z = (cos a, 0, sin a, 0) . . 

V>f = (0,1,0,0) , ^ = (0, cos 6,0, sin 6) {> 

Note that the 4 dimension of the Hilbert space of Eve's probe is not an assumption, 
but a consequence of the fact that only 4 states, ip z and ipf z , appear in eq. (0). 
The x-states may be expressed in terms of the z-states in the following way; 

\z) = ±(\x)+i\-x)) \-z) = ±(\x)-i\-x)) (4) 



When substituting the states in (||) with the ones in (|4|), one finds, using the linearity 
of U: 



x}®|0) ^(v / F|^)®V'o + ^|-' z )®V'i 

+ v^i ) (» 2 + v^l z ) ® v»r 2 ) 

VF| a: } ® \ (i^l + ^ z ) + (V>f + 
+ v^| -x ) I (i - ^) - (V>! + ^)) 



(5) 



where the ?/>g an d $f are now expressed in terms of ip^ z and ^f^: 

ri = i((Vo-% z )-^(ri-^ z ), 



(6) 



In a similar way the states ip x and tp-^ can be found. When requiring that 
{ipQ \i/jq) = 1 one obtains the following expression for the fidelity 

1 + cos b ^ 



2 — cos a + cos b 



Going through exactly the same procedure for the y-states and again requiring that 
{ipQ \iPq) = 1 one obtains in this case the following expression for the fidelity 

F= l ~ COSb - (8) 
2 — cos a — cos b 

Since the fidelity has to be the same in the two bases, the constrain cos b = is 
imposed, which means that the fidelity is given by, 

F = (9) 

2 — cos a 
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Notice that this implies that 

V>! = (0,1,0,0) , vr 2 = (o,o,o,i) (io) 

in other words, we now have that ( ip± \ ipi Z ) = 0, which implies that Eve can gain 
full information about the qubits received disturbed by Bob. Let us again emphasize 
that the x—y symmetry assumption which guaranties (|9|) is not a restriction, since all 
eavesdropping strategies are equivalent to a symmetric one []|, ||] . Notice furthermore 
that incoherent eavesdropping strategies on the 6-state protocol can be parameterized 
by a single real parameter a, in opposition to the 4-state case which requires 2 real 
parameters. 

Eve, of course, waits to hear which basis was used by Alice before she performs 
her measurements. For symmetry reasons it is therefore enough to consider the case 
where Alice sent a qubit in the z-basis; Eve first has to distinguish between the tpo 
and the ifix states. Since these states are orthogonal they can be separated perfectly 
with a standard von Neumann measurement — as already mentioned this means 
that Eve knows when Bob has received an error. Once she knows whether she has 
a tpo or a ^i-state, she has to distinguish between ?/>q and i/jq Z or between tpf and 
4>\ Z ■ The overlap between tpQ and ^ z is (i/jq \ ipQ Z ) = cos a, which means that Eve 
can make the right identification with probability p(s) = |(1 + sin a) and make an 
error with probability p(f) = \ (1 — sin a) fTo|| . Eve can distinguish the two f^i-states 
perfectly since they are orthogonal. 

It is now possible to evaluate Eve's probability of guessing the qubit correctly, 
P{G), the probability of guessing the qubit correctly when Bob received it undis- 
turbed P(G\undist), Eve' Shannon Information, Is, and her Renyi Information fTjJl , 
Ir, in terms of the obtained fidelity and probabilities: 

P(G) = F ■ p(s) + D (11) 
P{G\undist.) =p(s) = -(1 + sina) (12) 

Is = F ■ S s (p(f)) + D ■ S S (1) (13) 

where Ss(p(f)) = l+p(/)log 2 p(/)+p(s)log 2 p(s) is Eve's Shannon information on the 
^o-states and Ss^l) = 1 is her Shannon information on the V'l-states — remember 
that she has full information on the V'l-states. Finally, 

Ir = F- S R (p(J)) + D ■ S R (1) (14) 

where »S_r(p(/)) = 1 + log 2 (p 2 (/) +p 2 (s)) is Eve's Renyi Information on the V'o-states 
and Sr(1) = 1 is her Renyi information on the V'l-states. 
To conclude this section let us make two remarks: 

1. According to relation (||) the fidelity F can't decrease below 1/3. This implies 
that there is no way to spin-flip all the 6 states with a probability of success 
larger than 2/3 (which corresponds to the measurement fidelity fll2|] ). 

2. Using the Peres-Horodecki separability criterion for 2-qubit states |R| one can 
prove that Alice and Bob's qubits remain entangled for D < 1/3. Hence, using 
quantum purification and quantum privacy amplification |l4[] Alice and Bob can 
establish a secure secrete key for all D < 1/3 (note that D = 1/3 corresponds 
to the simple intercept-resend strategy). 
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3.1 A special case: The Universal Quantum Cloning Machine 

For increasing disturbance, Bob's fidelity F decreases, while Eve's probability P{G) 
of guessing the bit correctly increases (i.e. Eve's fidelity increases). Hence, they cross 
at a specific value of the fidelity F=P(G). This happens for F = 5/6. For this value of 
the fidelity the incoherent eavesdropping strategy turns out to be precisely identical 
to the Universal Quantum Cloning Machine introduced by Buzek and Hillery |15] 



and proven to be optimal in |16| , g, 17|. This is seen from the following: 



Uqcm\z) = \/l\z,Z,z) + y/l (\Z,-Z,-Z) + \-Z,Z,-z)) 
UqCm\-z) = sJ\\-Z,-Z,-z) + yfl(\-Z,Z,z) + \z,-Z,z)) 

Hence, the following identifications: 



= \Jl\ z ^ z ) + \/i\- z >- z 



F ^o Z = \ll\- z ,- z ) + \I\\ z , z ) 



lead to F = 5/6, D = 1/6 and that ( % \ % z ) = cos a = 4/5 and ( ipf | ^ 2 ) = 0. 

The states on the right hand side of eq. ( |l5| ) belong to the 3 qubit Hilbert space. 
The first qubit is the original one, the second one is the copy and the third one the 
internal (2-dimensional) state of the cloning machine. In quantum cloning the picture 
is that the original and the clone correspond to the output. In this case the internal 
state of the cloning machine provides no information at all neither on the original 
state nor on the success of the cloning process H. In the case of eavesdropping, 
on the opposite, the original qubit is viewed as the output of the eavesdropping 
machine, while Eve keeps the clone and the machine. Next, she waits to know the 
basis used by Alice. Using then a coherent measurement on both the clone and the 
copy-machine, Eve can determine whether or not the original qubit going to Bob is 
disturbed (the measurement has to be coherent because the subspaces spanned by 
the and by the ipf z are entangled). Moreover, in case Bob's qubit is disturbed, 
Eve can gain full information on the original qubit, contrary to the quantum cloning 
situation. 

This connection between incoherent eavesdropping on the 6-state protocol and the 
universal quantum cloning machine replaces the connection that was found between 



incoherent eavesdropping on the 4-state protocol and the Bell-CHSH inequality 1 15 , 
19, ||, p. This could be expected pC|] , since the Bell-CHSH inequality involves 4 states 
that lie in a plane on the Poincare sphere similarly to the 4-state protocol, while the 
universal quantum cloning machine treats all states symmetrically, similarly to the 
6-state protocol. The main difference between the two connections is that for the 
4-state protocol it happens when Eve and Bob Shannon information are equal, while 
for the 6-state protocol it happens when Eve and Bob fidelities (ie mean probability 
of correct guess) coincide. This can be traced back to the fact that the Bell inequality 
is a characteristic of mutual information between two random variables [^IJ while the 
universal quantum cloning is, by definition, optimized from the fidelity point of view. 
This suggest to look at the eavesdropping strategy for the 6-state protocol when Eve 
and Bob information coincide, but we could not find any interesting connection there. 
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4 2-qubit Coherent eavesdropping 



In the case of 2-qubit coherent eavesdropping Eve attaches one probe to two of the 
qubits sent by Alice. In order to avoid easy detection Eve makes her eavesdropping 
on qubits which are not necessarily sent successively. Again, after attaching her 
probe to the qubits, she let the system undergo a unitary transformation, which in 
this case looks as follows (k, k! = x, y, z): 



k,k'}®\0) 


u ; 
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(17) 



In these notations, the ip^ 3 denote Eve's probe state in the case Bob receives both 
qubits undisturbed. The V'n > ihl an d V2 correspond to the case that the first, sec- 
ond and both qubits are disturbed, respectively. The fidelity F and the disturbance 
D, as determined by Alice and Bob, are given by 

F = a + f3 , D = /3 + 7 (18) 

and satisfy 

F + D = a + 2/3 + ^ = 1. (19) 

As for the incoherent case, we write the states ( |17| ) in the Schmidt decomposition |10[| , 
hence all sets {ifi l ' 3 , V4i> ^12 > V ; 2"'}' = i^jij/ji^ are formed of four mutually 
orthogonal normalized states. Since we are considering (without loss of generality 
H) symmetric eavesdropping strategies this imposes some restrictions on the scalar 
products which characterize the unitary operation U used in Eve's attack. Here this 
means that the scalar products have to be invariant under the exchange of + and — 
directions of any of the two qubits, under the exchange of the state of the first qubit 
with the second qubit and finally under the change of basis. 

It is possible to divide the scalar products into 10 different groups (for details 
see Appendix A), each group defining a free parameter. When imposing the sym- 
metry and unitarity conditions the number of independent parameters is reduced 
to only two real ones. (The 4-state protocol requires 5 real parameters ||). These 
two parameters can be chosen in several different ways, but a convenient one for the 
problem under investigation is to chose a, (3 and 7, while keeping in mind the nor- 
malization condition (|l9|), and express the remaining parameters in terms of these 
three. 

This dramatic reduction in parameters has lead to the following conditions on the 
states of Eve's probe. First all scalar products between states of different kinds (e.g. 
a ipQ with a ipii) vanishes. Consequently Eve can know whether Bob received both 
qubits undisturbed, or both disturbed, or the first one disturbed but not the second 
one, or vice versa. Next, all 4 ^-states are mutually orthogonal. Third, all ip\\- 
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and ^12-states with different indices for qubit received disturbed by Bob are also 
orthogonal. Hence, as for incoherent eavesdropping, Eve can gain full information 
on all qubits received disturbed by Bob. Finally, for the tpu- and V'12-states the only 
scalar products different from zero are: 

(VWiT) = <V>iT*IV>r> = 

<v^iv>r> = (vrr 2 ivrr) = ^ (20) 

and finally non of the V'o-st.ates are orthogonal. 

Eve is now left in the following situation: After her eavesdropping attack, she 
first has to distinguish between the four types of states her probe could be left in, 
i.e. whether she remains with a ipo, ipxi, ^12 or a -02-state. Since these four types of 
states are orthogonal Eve will after her first measurement know exactly which kind 
of the four she posses. Suppose she finds that she remains with a ^2-state, since 
the states within this subset are all orthogonal Eve can again identify with certainty 
which one of them she has. 

For the ipu and ^12-states she has to distinguish between states which are not all 
orthogonal, but fulfill (|20|), these states can in an optimal way be chosen as follows: 

ipff = cos 9 ■ e\ + sin 9 ■ e 3 

ipf{ z = cos#-e 2 + sin6>-e 4 . . 

ip{^ z = sin 9 ■ ei + cos 9 • e 3 ^ ' 

ip{i~ z = sin 9 ■ e 2 + cos 9 ■ e 4 

where {ej} is an ortho-normal basis. Eve again uses a standard von Neumann mea- 
surement with eigenstates ej to distinguish these states. If the outcome of her mea- 
surement is the state e\ she interprets this as if the initial state was ^>ff , where as 
if she finds the state e 2 she interpret it as ipi~[ z , etc. In this way her probability for 
making the correct conclusion is P\2 = cos 2 #, and probability P\\ = siv?6 for making 
an error. (We use the notation Pjj to denote Eve's probability of guessing correctly 
j qubit when i of the qubits arrive disturbed to Bob). Similarly for the i/>i2-states. 

For the Vo-states the situation is more complicated since non of the states are 
orthogonal. Let us again introduce an ortho-normal basis {ej} and expand the i/jq 
states fl2T 



i(jq z = a • ei + b • e 2 + b ■ e 3 + c • e 4 

i^q~ z = b • ei + a ■ e 2 + c • e 3 + b • e 4 

^0 ZZ = b- e\ + c • e 2 + a ■ e 3 + b • e 4 

to 



(22) 



V> 2 z = c • e i + b ■ e 2 + b • e 3 + a • e 4 



where a, b, c satisfy the normalization a 2 + 26 2 + c 2 = 1 and constrains imposed by the 
scalar products among the Vto's, as described in appendix A. Defining (k,l,k',l' = 
±z): 

1. Aj = a( ipQ 1 1 ipQ 1 ' )=product among iJjqs with j differences between the indices 
kl and kT, j = 1,2, 

2. Bi = (3( V^j I iff/ )=product among ipij's with one difference between the in- 
dices kl and kT corresponding to the undisturbed qubit (e.g. B\ = j3( \ i^ 1 ) 
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we obtained: 

Ai = a-/3 fli = 0-7 . , 

A 2 = a-2/3 + 7 1 j 

while all other scalar product vanish. Notice that as in the incoherent eavesdropping 
case, Eve gains full information on all qubits that arrive disturbed to Bob. 

As before, Eve interprets the outcome e\ of her measurement as if the initial 
state was ipQ Z , the outcome e 2 as if the initial state was i/ij' 2 etc. Her probability of 
making the right conclusion about the state is thus P02 = o?, in this case she will 
have both qubit sent by Alice correctly. With probability Poi = 26 2 she will get the 
state wrong with the following consequence: she will have one of the qubits sent by 
Alice correct and the other wrong. There is of course two ways to obtain this; either 
the first qubit is correct and the second wrong or the first qubit is wrong and the 
second correct. Finally Eve will with probability Poo = c 2 get the state wrong, with 
the consequence that she will draw the wrong conclusion about both qubits. 

P12, Pii, P02, Pqi and PoOi can all be expressed in terms of the three parameters 
a, and 7, see Appendix B. 

It is now possible to compute Eve's probability of guessing both of the two qubits 
correctly, P C (G), her probability P c (G\undist.) of guessing one qubit correctly when 
Bob received it undisturbed, as well as her Shannon Information, Ig and her Renyi 
Informations, I R , in terms of the found probabilities; 

P C (G) = a ■ P 02 + 2(5 ■ P12 + 7 (24) 

nGlundi st.) _ ^B±lM±mi (25) 

v ' ; a + /3 v ' 

I c s = a-S c s (P 02 ^Poi^Poi,Poo) + 2/3-^(^2,^1!, 0,0) ^ 

+ 7-^(1,0,0,0) W 

where S%(pi,p 2 ,p 3 ,P4) = 2 + pilog 2 pi + p 2 log 2 p 2 + P3^og 2 p 3 + P^og 2 pi. 

I R = u-S c R (Po2,lPoi,lPoi,Poo) + 2/3-^(Pl 2 ,Pll,0,0) 

+ 7-^(1,0,0,0) 1 '> 

where S c R (p 1 ,p 2 ,p 3 ,p 4: ) = 2 + log 2 (pf + p\ +p\ + p\)- 

A special case of 2-qubit attack is of course a double incoherent attack. It is 
straightforward, though cumbersome, to check that this corresponds to a = F 2 , 
(5 = FD, 7 = D 2 and that all the above formula reduce then to the corresponding 
ones in section ||, with all of Eve's probe states factoring, e.g. Vi 2 = V'o ® ^1 ■ 

In order to understand what Eve can gain using coherent instead of incoherent 
eavesdropping, we investigated numerically all four quantities P C (G), P c (G\undist.), 
Ig and I R searching each time for the optimal value of a for a given disturbance D 
and compared this with the corresponding quantity obtained for the same distur- 
bance with incoherent eavesdropping. Let us first consider P C (G), the probability 
that Eve guesses the bits correctly. Figure 1 presents the results. The long curve 
from D = 0to-D = 0.5 corresponds to the incoherent eavesdropping strategy, while 
the 4 shorter curves correspond to different coherent eavesdropping strategies. For 
each of the latter, the parameter a is fixed at the indicated value (7/8, 3/4, 1/2 and 
1/4). Since a and the disturbance cannot vary independently over the entire range, 
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the 4 curves are only plotted for possible values of D around the value that maximizes 
P C (G). Note that for disturbance, Eve has a probability 0.25 of guessing correctly 
both qubits. More important, this figure shows that coherent attacks can slightly 
increase Eve's fidelity P C (G). This can more clearly be seen on the inset which dis- 
plays a zoom of the a = 7/8 case. This result differs from the other probability of 
interest, namely Eve's probability of rightly guessing a qubit received undisturbed by 
Bob, P c {G\undist). Indeed, numerical evidence show that P c (G\undist.) is maximal 
precisely for a = F 2 , that is precisely when the 2-qubit coherent attack reduce to 
double incoherent attacks. Consequently, the use of coherent eavesdropping strate- 
gies can increase Eve's probability of guessing correctly 2 qubits. However, if one 
restricts the probability to those qubits received undisturbed by Bob, then coherent 
eavesdropping is of no use to Eve (at least for 2-qubit eavesdropping). 

For Eve's information, the situations are depicted on figure 2 (Shannon informa- 
tion) and 3 (Renyi information). It turns out that Eve Shannon information is not 
increased by coherent attacks, while her Renyi information is (slightly) increased. It 
might seem strange that Eve's fidelity increases without a corresponding increase in 
her Shannon information, but this can be understood as indicating that the prob- 
ability that Eve guesses correctly both qubits is compensated by a corresponding 
increase of her probability to guess wrongly both qubits. 



5 3-qubit coherent eavesdropping 

The generalization to 3-qubit coherent eavesdropping is now straightforward. In 
brief, the unitary interaction between the 3 qubits and Eve's probe (generalizing 
(U)) reads: 

\k,k,k) ® |0) v 7 " \k,k,k) ®^ kk 

+ \ff3 (| k,k,-k) tg> # + \k,-k,k)® # + \-k,k,k)® # 
+ k, -k, -k ) <8> 1P21 k + I ~ k > k,-k)<g) V>22 fe + I - k > -k,k)<g> tp23 k 

+ V6 | -k,-k,-k) ®ip kkk (28) 

where ifjQ kk denotes Eve's probe state in case none of the qubits is disturbed, ip kk k in 
case the jth qubit and only this one is disturbed, ip k j ^ n case an qubits are disturbed 
except the jth one, and tp kkk in case all 3 qubits are disturbed. The fidelity and 
disturbance read: F = a + 2/3 + 7 and D = (3 + 2^ + 5, with normalization F + D = 1. 
As for the 2-qubit case, unitarity and symmetry imposes severe restrictions on the 
scalar products. Using the following notations (k, I, m, k' , I', m! = ±z): 

1. Aj = a( ifjQ lm I ipQ 1 ' 171 ' )=product among ^o' s with j differences between the 
indices klm and k'l'm', j = 1, 2, 3, 

2. B\ = P{ip k j m I ifj k 'j' m ' )=product among ipij's with one difference between the 
indices klm and k'l'm' corresponding to an undisturbed qubit (e.g. B\ = 

3. B>2 = f3(ip k j m I ipi} m )=product among V'lj's with two differences between the 
indices klm and k'l'm' corresponding to the two undisturbed qubits (e.g. B2 = 

4. C\ = 7( ip kl j m I ^2/ m ) =product among ip2j 's with one difference between the in- 
dices klm and k'l'm' corresponding the undisturbed qubit(e.g. G\ = 7( ip^i™ I ^21 m ))> 
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we obtained, see appendix C: 



A x = a -(3 B x = (3 -7 

A 2 = a -2/3 + 7 B 2 = (3-2^ + 5 (29) 

A 3 = a -3(3 + 3 7 -8 C x = 7 - 5 

while all other scalar product vanish. Notice that again Eve gains full information 
on all qubits that arrive disturbed to Bob. 

Once Eve knows which kind of states she has, an information she can reliably 
get, as in the previous cases, she is left with the problem of optimally distinguishing 
among the states of that kind. The corresponding probabilities are summarized in 
appendix C. The main result is that using 3-qubit coherent eavesdropping does not 
improve Eve' Shannon information. Nor does it improve Eve's probability of guessing 
correctly a bit received undisturbed by Bob: 

P*(G\und is t.) = °W»+^ + fln> + Wfi» + fl«> + 7fl B (30) 

ot 1 I / "y 

= P{G\undist.f (31) 



where P{G\undist.) is given by relation (|12|). 

However, it improves the probability that Eve guesses correctly all three qubits: 

P C {G) = aP 03 + 3pP 13 + 37P23 + S (32) 
> P(G) 3 (33) 

where P(G) is given by relation (|TT|). 

Contrary to the 2-qubit case, the gain is not neglectable: for a disturbance of 7% 
the gain on Eve's probability P C (G) of guessing all 3 qubits correctly is increased by 
6%, with respect to incoherent eavesdropping. This contrasts with the 1.7% increase 
shown in figure 1 for the 2-qubit case. Note however, that this larger gain is over a 
lower probability P(G) 3 . 



6 Error correction and privacy amplification 

In this section we discuss the possibility that Eve keeps her probe until after Alice 
and Bob have carried out the error correction and the privacy amplification phase 
of the protocol, using the public channel. Eve can then measure her probe taking 
into account all the information she got from the public channel, optimizing her 
information on the final key. We shall consider only a simply error correction and 
privacy amplification protocol. This protocol is far from optimal (most bits are 
wasted), but showing that Alice and Bob are safe using this simple protocol, would 
prove that quantum cryptography can be made secure even on noisy channels. The 
protocol goes as follows. After Alice and Bob have recorded their raw key (qubits 
send and received in the same basis) , they randomly chose pairs of bits and compute 
their xor sum. For error correction, they announce the xor value and keep the first 
bit if and only if they agree on the xor value (the second bit is always discarded). 
For privacy amplification, Alice and Bob do not announce the xor value, but discard 
the 2 randomly chosen bits while keeping the xor sum for a new key with improved 
privacy [p3| . Hence, the problem for Eve is to measure her probe in such a way 
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as to maximize her likelihood to correctly guess the xor sum of two given qubits 
(in known bases). Clearly, Eve learns which qubits are paired only after her probe 
has interacted with the qubits, hence the interaction between the qubits and the 
probes can still be assumed symmetric and identical for all qubits, as described in 
the previous section. 

The problem of finding Eve's optimal measurements is a very difficult one. In 
this section we shall merely use the best measurement we have found. Due to the 
symmetry of the problem we believe that these measurements are optimal, though we 
recognize that this is an unproven assumption. Also, we shall assume that all qubits 
received disturbed by Bob are removed during the error correction phase, hence we 
shall only consider the qubits that Bob receives undisturbed. 

Let us first consider the case of incoherent eavesdropping, that is Eve attaches 
one probe per qubit. For this case the best measurement for Eve that we could 
find consists simply in measuring each probe separately (this is more efficient, in 
particular, than to measure whether the two probes are jointly in a singlet or triplet 
state). Then, the probability that Eve guesses correctly the xor sum of the two bits 
reads: 

P*rl = P 2 + (1 " Psf = 1 " (34) 



where P s is the probability that Eve guesses correctly any undisturbed bit, see (|i2|), 
and D is the disturbance. Figure 4 displays P xor i in function of the disturbance 
(lower curve). 

Next, we consider the case of 2-qubit coherent eavesdropping. In general the two 
qubits attached to one probe will not be paired by Alice and Bob. However, for 
the argument, let us assume that Eve would like to guess the xor value of the bits 
corresponding to a single probe. The optimal measurement we found reads: 

Pxor2 = PoO + P02 (35) 

where Poj is the probability that Eve guesses correctly j of the two bits (assuming 
both are undisturbed). Using the equations ( |46| ) of appendix B one obtains: 



Pxori = — ( 3 - a - 4D + V9a - 5 + 6Dy/a -1 + 2D] (36) 
4a \ / 
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For D > i 

Pxor2 reaches the maximal value of 1 for a — 1 ^ . For D 6 [- 
the maximum is reached for a = 5-21D+28D 2 -12D 3 _ F ina n V) for D < the 
maximum is reached for a = 1 — D. Figure 4 displays the maximum values of P XO r2 in 
function of the disturbance D (upper curve). This clearly shows that Eve gains using 
2-qubit eavesdropping instead of incoherent eavesdropping (lower curve) (except for 
D = 3 ~q )- Accordingly, Eve gains using 2-qubit coherent eavesdropping, provided 
she is lucky enough that Alice and Bob chose to pair the two qubits. However, such a 
lucky coincidence is practically excluded if the total number of qubits is much larger 
than two. 

In order to increase the chance that Alice and Bob randomly chosen pairs of bits 
are attached to the same probe, Eve should use n-qubit attacks with large n. Let 
us consider the case n=3 (still not very large, but large enough that several pairing 
are possible). For this case, we found that Eve's optimal measurement provides her 
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with the following probability of a correct guess of the xor value: 

(37) 



jnowmg prouaumiy 01 a con ecu guess 01 uie xor vaiue: 
PxorZ = (a(P 03 + \p m + \p 1 + POO) + P(Pl3 + Pll)) —^"5 

V 3 3 / a + p 



where the explicit form of the Pij are given in appendix C eqs. (47) - (|50|). Numerical 



optimization of P XO r3 is shown on figure 4 (middle curve). It shows that while Eve 
gains more information using a 3-qubit coherent strategy than an incoherent one, 
she gains less than using a 2-qubit strategy. Based on this result, we conjecture that 
Eve gains less using an n-qubit strategy than using a m-qubit one, with m < n. 
However, this should be balanced against the fact that the probability that Alice 
and Bob chose pairs of bit corresponding to the same probe increases with n. 

The argument concludes now as follows. Assume Eve uses n-qubit coherent eaves- 
dropping. If, on the one side, n is too small, then the probability that the pairs of 
bits used for error correction and privacy amplification correspond to the same probe 
is small. In this case Eve does not gain delaying her measurement until after privacy 
amplification. On the other side, if n is too large, then Eve's information gain is neg- 
ligibly larger than if she would use incoherent eavesdropping. Finally, for incoherent 
attacks, Eve does not gain anything by delaying her measurement until the privacy 
amplification phase of the protocol. Hence, under the plausible assumptions that 
the measurements used in this section are indeed optimal, we conclude that Eve's 
optimal strategy consists in attaching one probe per qubit (i.e. incoherent eavesdrop- 
ping) and to measure her probe as soon as she learns the basis. The only additional 
information she can then get is during the error correction public discussion (a purely 
classical problem) for which bounds are known. 

7 Concluding remarks 

Coherent eavesdropping strategies are unpractical with today's technology. However, 
it is important for the reliability of quantum cryptography to clarify the question 
of whether such strategies could in the future affect its security. Assuming that 
the results presented in this article for 2- and 3-qubit coherent strategies can be 
generalized to arbitrary n-qubit strategies, one should be optimistic for quantum 
cryptography. Indeed, neither the Shannon information, nor Eve's probability of 



guessing correctly a bit received undisturbed by Bob [24] can be increased using 
coherent attacks. Admittedly, a complete analysis of eavesdropping strategies should 
incorporate the possibility that Eve keeps her probes until Alice and Bob have carried 
out all the public discussion part of the protocol, including the privacy amplification 
protocol. Such an analysis is sketched in section || where we present arguments based 
on the classification of eavesdropping strategies presented in the previous sections 
concluding that Eve could only gain a negligible small addition information which 
would not affect the security of the entire protocol. 



The connection to optimal quantum cloning machines, described in section |3.1| , 
generalizes to the 6-state protocol the connection to the Bell inequality found for the 
4-state protocol fl9|, [j| |6[. Possible connections between coherent eavesdropping and 
quantum cloning of higher dimension systems remains an open problem. There is an 
interesting connection between, on the one hand side, the fact that optimal quantum 
cloning machine never produce more errors than the number of additional copies || , 
and, on the other side, that in optimal eavesdropping Eve gains full information on 
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all qubits that arrive disturbed to Bob: for all disturbed qubits, Eve knows that her 
copy is perfect (if not, there would be more errors than additional copies). 

Using the highly symmetric 6-state protocol introduced in section |2|, one can pa- 
rameterize all incoherent eavesdropping strategies by a single real parameter and all 
2-qubit coherent strategies with 2 real parameters and all 3-qubit strategies with 3 
real parameters. Hence, all these cases can be analyzed in details. Our results show 
that using coherent attacks, Eve can improve on some tasks, like for example increas- 
ing her probability of guessing both qubits correctly, but that she can't gain for some 
other tasks, like for example guessing correctly a qubit received undisturbed by Bob. 
In addition to its relevance for the study of the security of quantum cryptography 
over noisy channels, this result illustrates that some tasks can be improved by using 
quantum coherence, while some other tasks cannot. 
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A 2-qubit coherent eavesdropping: Constrains on Eve's 
probes and reduction of parameters 

Eve applies a symmetric eavesdropping strategy |J]. This imposes some constrains 
on the scalar products. Namely, that the scalar products have to be invariant under 
the exchange of + and — directions of any of the two qubits, under the exchange 
of the state of the first qubit with the second qubit and finally under the change of 
basis. Define the following parameters: 
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(38) 



Note that Aj involved the scalar product between two ^o-states (i.e. states corre- 
sponding to both of Bob's qubits undisturbed) with j different indices, j = 1, 2. B\, 
B 2 and B% involve states corresponding to one of Bob's qubit disturbed (i.e. ipu- or 
^12-states) with the same index for the undisturbed qubit, the same index for the 
disturbed qubit and different indices for both qubit, respectively. Finally, the Cj, 
j = 1,2 involve states corresponding to both qubits disturbed (i.e. ^-states) with j 
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different indices. The symmetry under exchange of the directions and states of the 
two qubits together with the unitarity condition gives that the parameters have to 
fulfill the following relations: 

a - p = A 1 + B 2 0- 1 = B l + C 1 
B<2 — B3 = C\ + C 2 A\ — A 2 = B3 + B\ 

In this way the number of parameters have been reduced from 10 down to 5 real 
parameters. By imposing the invariance under change of basis, the number of pa- 
rameters is further reduced to only two independent. They can, of course, be chosen 
in many different ways, but a convenient one is choosing a, and 7 and express 
all other parameters in terms of these three, while remembering the normalization 
condition (p~9|) : 

A 1 = a- f3 A 2 = a - 2/3 + 7 

Bi=|3-7 B 2 = B 3 = (40) 

Ci = c 2 = 

Note that all scalar products between probe-states corresponding to qubits received 
disturbed by Bob vanish. Hence, Eve can gain full information on these qubits. 



B 2-qubit coherent eavesdropping: determinations of 
the Pij probabilities 

Using the overlaps between the various states (given in appendix A) together with the 



expressions of the V>n- and V'12-states, see equation (|2l|), one finds that 2 sin 6 cos 9 
Bi/(3, hence 
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cos 2 # 

1 



1 + (B 1 /0) + Jl - (B 1 /P)) 



1 + - 7V/? 2 



(41) 



For the V'o-states, let us introduce the vectors 



>^o K >o z z ) and 



e = (ei, e2, e3, 64) whose entries are elements of Eve's probe Hilbert space. The ej 
are the eigenstates of Eve's measurement, hence they are mutually orthogonal f22| . 
The entries of the matrix X = | e)(ip \ are the probability amplitudes for the various 
possible outcomes. The matrix X can be easily computed from: 



x ] x = I = - 



fa Ai At A 2 \ 

Ai a A 2 A 1 

At A 2 a A 1 

\A 2 A x A-y a j 



(42) 



Hence, one obtains the probabilities that define relation (E2 



(ei I ip z ,z ) 
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Ao 



(43) 
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<*i^>-j J i+ - +a --v i+ --4) 

4 I V a a V a a 



4 I y ay a ay a a/ 
Finally, the probabilities Poj that Eve guesses correctly j bits are 

P 02 = a 2 Pol = 26 2 and P 00 = c 2 . (46) 

C 3-qubit eavesdropping: probability for Eve's guesses 

If Eve is left with a ip 3 lm state, then she can know all three qubits (recall that all 
the 8 Tp^ lm states are mutually orthogonal). 

If Eve is left with a tp^j" 1 state, then, using the same technique as in appendix B, 

one finds that she has probability P23 = |(1 + yl — Cf/j 2 ) to guess correctly all 3 
qubits and P22 = 1 — P23 to make one error. 

If Eve is left with a V>ij m state, then, using the same technique as in appendix 
B, one finds that she has probability Py to guess correctly j qubits, with j=l,2,3. 
The formula are the same as for 2-qubit coherent eavesdropping, see fl43] ) to (|45|) , 
but with the ^4 n and a replaced by P n and /?, respectively: P13 = a 2 , P12 = 26 2 and 
P11 = c 2 . 

If Eve is left with a ^q'" 1 state, then, using again the technique of appendix B, 
one finds that she has: 
Probability to guess correctly all 3 qubits= 

p 03 = ttt- ( Ja + A 3 + 3(A 1 +A 2 ) + 3^« -A 3 + A 1 -A 2 
64a v 

2 



+ yja - A 3 - 3(^i - ^2) + 3^a + ^3 - M - A 2 ), (47) 
Probability to guess correctly 2 of the 3 qubits= 



P02 = ~r ( Ja + A 3 + 3{A X + A 2 ) + Va - A 3 + Ai - A 2 
64a v 

2 



; a - ^3 - 3(Ai - ^ 2 ) - + A 3 - A 1 - A 2 ) 2 , (48) 
Probability to guess correctly 1 of the 3 qubits= 

Po1 = 64^ ^ \/ a + j43 + 3 ( Al +j42 ) ~ v 7 " - ^3 + -4i - -42 

+ yJ a -A 3 - 3(Ai - ^ 2 ) - v 7 " + -43 - M - A 2 ) 2 , (49) 

Probability to guess correctly none of the 3 qubits= 
1 



Po0 = 64a" ^ V " + ^ 3 + 3 ^ Al + A ^ ~ 3 ^ a ~ A 3 + A i~ A 2 



a -As- 3(Ai - A 2 ) + 3^a + A 3 -A l -A 2 f. (50) 
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Figure Captions 



1. Probability that Eve guesses correctly two bits out of two in function of the 
disturbance D. The long curve from D = to D = 0.5 corresponds to the 
incoherent eavesdropping strategy of section [3|, while the 4 shorter curves corre- 
spond to different 2-qubit coherent eavesdropping strategies described in section 
|4]. For each of the latter, the parameter a is fixed at the indicated value (7/8, 
3/4, 1/2 and 1/4). This figure shows that coherent attacks can slightly increase 
Eve's fidelity P C {G). This can more clearly be seen on the inset which displays 
a zoom of the a = 7/8 case. 

2. Same as figure 1, but for Eve's Shannon information. Coherent eavesdropping 
does not improve Eve's Shannon information. 

3. Same as figure 1, but for Eve's Renyi information. Coherent eavesdropping does 
slightly improve Eve's Renyi information. 

4. Probability that Eve guesses correctly the xor sum of two bits. The lower 
curve corresponds to incoherent eavesdropping. The upper and middle curves 
corresponds to 2-qubit and 3-qubit coherent eavesdropping assuming the two 
bits correspond to qubits attached to the same probe. 
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